Vulnerability in Microsoft Asp.net Core 6.0
CVE-2025-7326
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future…
EPSS: 0.009 (76.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H.
Affected products
- Microsoft Asp.net Core 6.0 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-arm — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-arm64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-musl-arm — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-musl-arm64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-musl-x64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.linux-x64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.osx-arm64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.osx-x64 — versions >=6.0.0
- Microsoft Microsoft.aspnetcore.app.runtime.win-arm — versions >=6.0.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-7326?
- CVE-2025-7326 is a high-severity vulnerability in Microsoft Asp.net Core 6.0, classified under Weak Authentication. CVSS score: 7.0/10. Published 2025-07-08.
- How severe is CVE-2025-7326?
- High severity. CVSS v3 base score is 7.0 out of 10.